host side TLB flush can be merged together if multiple
spte need to be write-protected.

Signed-off-by: Yaozu (Eddie) Dong <eddie.dong@intel.com>

diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
index 92ac0d1..749db46 100644
--- a/drivers/kvm/mmu.c
+++ b/drivers/kvm/mmu.c
@@ -524,9 +524,9 @@ static void rmap_write_protect(struct kvm *kvm, u64 gfn)
 		rmap_printk("rmap_write_protect: spte %p %llx\n", spte, *spte);
 		if (is_writeble_pte(*spte))
 			set_shadow_pte(spte, *spte & ~PT_WRITABLE_MASK);
-		kvm_flush_remote_tlbs(kvm);
 		spte = rmap_next(kvm, rmapp, spte);
 	}
+	kvm_flush_remote_tlbs(kvm);
 }
 
 #ifdef MMU_DEBUG